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NATIONAL RECORDS OF SCOTLAND 
NATIONAL RECORDS OF SCOTLAND TERMS AND CONDITIONS 2 (NRSTC2) 
CONDITIONS OF CONTRACT FOR THE PURCHASE OF SERVICES 


These Conditions may only be varied with the written agreement of the Purchaser. No 
terms or conditions put forward at any time by the Supplier shall form any part of the 
Contract unless specifically agreed in writing by the Purchaser. 
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1. DEFINITIONS 
In these Conditions: 


“Contract” means the contract between the Purchaser and the Supplier consisting of 
the Purchase Order, these Conditions and other documents (or parts thereof) 
specified in the Purchase Order; 


“Data Controller’, “Data Processor”, “Data Subject” and “Data Subject Access 
Request” have the meanings given in the Data Protection Laws; 


“Data Protection Laws” means any Law, statute, subordinate legislation regulation, 
order, mandatory guidance or code of practice, judgment of a relevant court of Law, or 
directives or requirements of any regulatory body which relates to the protection of 
individuals with regard to the processing of Personal Data to which a Party is subject 
including the Data Protection Act 2018 and any statutory modification or re-enactment 
thereof and the UK GDPR; 


‘Good Industry Practice’ means standards, practices, methods and procedures 
conforming to legal and regulatory requirements and the degree of skill and care, 
diligence, prudence and foresight which would reasonably and ordinarily be expected 
from askilled and experienced person or body engaged in a similar type of undertaking 
as the Supplier under the same or similar circumstances. 


“Information Commissioner” means the Commissioner as set out in Part 5 of the Data 
Protection Act 2018. 


“Intellectual Property Rights” means all copyright, patent, trademark, design right, 
database right and any other right in the nature of intellectual property whether or not 
registered, in any materials or works in whatever form (including but not limited to any 
materials stored in or made available by means of an information technology system and 
the computer software relating thereto) which are created, produced or developed as part of 
the Services by or on behalf of the Supplier; 


“Law” means: 

(a) any applicable statute or proclamation or any delegate or subordinate 
legislation; 

(b) any enforceable right forming part of retained EU Law within the meaning of 
the European Union (Withdrawal) Act 2018; 

(c) any applicable guidance, direction, determination, or regulations with which 
the Purchaser and/or the Service Provider is bound to comply; 

(d) any applicable judgment of a relevant court of Law which is a binding 
precedent in Scotland; and 

(e) and requirements of any regulatory body; 


in each casein force during the period of the Contract in Scotland. 
“Personal Data” has the meaning given in the Data Protection Laws; 


“Premises” means the location where the Services are to be performed, as specified 
in the Purchase Order; 


“Processing” has the meaning given in the Data Protection Laws and cognate 
expressions shall be construed accordingly; 


“Purchase Order” means the document setting out the Purchaser’s requirements for 
the Contract; 
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2.1 


2.2 


2.3 


3.1 


3.2 


“Purchaser” means the Registrar General of Births, Deaths and Marriages for Scotland; 
“Schedule” means a schedule annexed to and forming part of these conditions; 
“Services” means the services to be provided as specified in the Purchase Order 

and shall, where the context so admits, include any materials, articles and goods to 

be supplied thereunder; 


“Supplier” means the person, firm or company to whom the Contract is issued; 


“Third country” means a country or territory outside the United Kingdom. 


and 


“UK GDPR’” means Regulation (EU) 2016/679 of the European Parliament and of the 
Council of 27th April 2016 on the protection of natural persons with regard to the 
processing of Personal Data and on the free movement of such data (General Data 
Protection Regulation) as it forms part of the Law of England and Wales, Scotland and 
Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 and 
as amended by the Data Protection, Privacy and Electronic Communications 
(Amendments etc) (EU Exit) Regulations 2019. 


CHANGE TO CONTRACT REQUIREMENTS 


The Purchaser may order any variation to any part of the Services that for any other 
reason shall in the Purchaser’s opinion be desirable. Any such variation may include 
(but shall not be restricted to) additions, omissions, alterations, substitutions to the 
Services and changes in quality, form, character, kind, timing, method or sequence of 
the Services. 


Save as otherwise provided herein, no variation of the Services as provided for in 
Condition 2.1 hereof shall be valid unless given or confirmed in the form of an order 
given by the Purchaser. All such orders shall be given in writing provided that if for any 
reason the Purchaser shall find it necessary to give any such order orally in the first 
instance the Supplier shall comply with such oral order which must be confirmed in 
writing by the Purchaser within 2 working days of the giving of such oral order by the 
Purchaser, failing which the variation made by such oral order shall cease to have effect 
on the expiry of the said 2 working day period. 


Where any such variation of the Services made in accordance with Condition 2.1 and 
2.2 has affected or may affect the costs incurred by the Supplier in providing the 
Services, the Supplier will notify the Purchaser in writing of the effect which it has had 
or may have on the said costs and such notification shall be considered by the 
Purchaser, who shall take all of the facts into account (including such information as 
may be provided by the Supplier in respect of the effect which such variation has had 
or may have on the costs incurred by the Supplier in providing the service) and may 
authorise such alteration to the sums to be paid to the Supplier in accordance with the 
provisions of the Contract as are, in the Purchaser’s opinion, appropriate and 
reasonable in the circumstances. 


INSPECTION OF PREMISES AND NATURE OF SERVICES 


The Supplier is deemed to have inspected the Premises before tendering so as to 
have understood the nature and extent of the Services to be carried out and is 
deemed to be satisfied in relation to all matters connected with the Services and 
Premises. 


The Purchaser shall, at the request of the Supplier, grant such access as may be 
reasonable for this purpose. 
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4.1 


4.2 


4.3 


4.4 


4.5 


4.6 


4.7 


4.8 


4.9 
4.10 


4.11 
4.11.1 


4.11.2 


SECURITY AND ACCESS TO THE PURCHASER’S PREMISES 


Any access to, or occupation of, the Purchaser’s premises which the Purchaser may 
grant the Supplier from time to time is on a non-exclusive licence basis free of charge. 
The Supplier must use the Purchaser’s premises solely for the purpose of performing 
its obligations under the Contract and must limit access to the Purchaser’s premises 
to such individuals as are necessary for that purpose. 


The Supplier must comply with the Purchaser’s policies concerning Baseline 
Personnel Security Standard checks and such modifications to those policies or 
replacement policies as are notified to the Supplier from time to time. 


The Supplier must notify the Purchaser of any matter or other change in circumstances 
which might adversely affect future Baseline Personnel Security Standard clearance. 


At the Purchaser’s written request, the Supplier must provide a list of the names and 
addresses of all persons who may require admission to the Purchaser’s premises in 
connection with the Contract, specifying the capacities in which they are concerned 
with the Contract and giving such other particulars as the Purchaser may reasonably 
request. 


The Supplier must ensure that any individual Supplier Representative entering the 
Purchaser’s premises has completed the process for obtaining Baseline Personnel 
Security Standard clearance. The Supplier acknowedges that the Purchaser has the 
right to deny entry to any individual that has not completed the process for obtaining 
Baseline Personnel Security Standard clearance. 


In accordance with the Purchaser’s policies concerning visitor access, entry to the 
Purchaser’s premises may be granted to individual Supplier Representatives for the 
purposes of meetings, notwithstanding that the process for obtaining Baseline 
Personnel Security Standard clearance has not commenced or completed. 


The Purchaser may, by notice to the Supplier, refuse to admit onto, or withdraw 
permission to remain on, the Purchaser’s premises any Supplier Representative 
whose admission or continued presence would, in the opinion of the Purchaser acting 
reasonably, be undesirable. 


The Purchaser must provide advice and assistance acting reasonably to the Supplier 
to facilitate the Supplier’s compliance with this Condition. 


All decisions of the Purchaser under this Condition are final and conclusive. 


Breach of this Condition 4 by the Supplier is a material breach for the purposes of 
condition 19.2 (Termination). 


If cyber security requirements apply to this Contract: 


then these are set out in a Schedule Part 2 (Cyber Security Requirements) to this 
Contract; and 


in that case the Supplier shall comply with the provisions of Schedule Part 2 (Cyber 
Security Requirements) 


and this Condition 4.11 shall not apply where the Contract does not include a Schedule 
Part 2 (Cyber Security Requirements). 


In this Condition 4,‘Baseline Personnel Security Standard’ means the pre-employment 
controls for all civil servants, members of the Armed Forces, temporary staff and 
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government contractors generally. 


‘Supplier Representatives’ means all persons engaged by the Supplier in the performance of 
its obligations under the Contract including: 


= its employees and workers (including persons employed by a third party but 
working for and under the control of the Supplier); 

= its agents, suppliers and carriers; and 

= any sub-contractors of the Supplier (whether approved under Condition 21 


(Assignation and sub-contracting) or otherwise) 


S SUPPLIER’S STATUS 


In carrying out the Services the Supplier shall be acting as principal and not as the agent of 
the Purchaser. Accordingly: 


(a) the Supplier shall not (and shall procure that the Suppliers agents and 
servants do not) say or do anything that might lead any other person to believe 
that the Supplier is acting as the agent of the Purchaser, and 


(b) nothing in this Contract shall impose any liability on the Purchaser in respect 
of any liability incurred by the Supplier to any other person but this shall not 
be taken to exclude or limit any liability of the Purchaser to the Supplier that 
may arise by virtue of either a breach of this Contract or any negligence on 
the part of the Purchaser, or the Purchaser’s staff or agents. 


6. SUPPLIER’S PERSONNEL 


6.1 The Supplier shall take the steps reasonably required by the Purchaser to prevent 
unauthorised persons being admitted to the Premises. If the Purchaser gives the 
Supplier notice that any person is not to be admitted to or is to be removed from the 
Premises or is not to become involved in or is to be removed from involvement in the 
performance of the Contract, the Supplier shall take all reasonable steps to comply 
with such notice and if required by the Purchaser the Supplier shall replace any 
person removed under this Condition with another suitably qualified person and 
procure that any pass issued to the person removedis surrendered. 


6.2 If and when instructed by the Purchaser, the Supplier shall give to the Purchaser a 
list of names and addresses of all persons who are or may be at any time concerned 
with the Services or any part of them, specifying the capacities in which they are so 
concerned, and giving such other particulars and evidence of identity and other 
supporting evidence as the Purchaser may reasonably require. 


6.3 Thedecisionof the Purchaser shall be final and conclusive as to whether any person 
is to be admitted to or is to be removed from the Premises or is not to become 
involved in or is to be removed from involvement in the performance of the Contract 
and as to whether the Supplier has furnished the information or taken the steps 
required of the Supplier by this Condition. 


6.4 | The Supplier shall bear the cost of any notice, instruction or decision of the Purchaser 
under this Condition. 


Té MANNER OF CARRYING OUT THE SERVICES 
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7.1 The Supplier shall make no delivery of materials, plant or other things nor commence 
any work on the Premises without obtaining the Purchaser’s prior consent. 


7.2 Access to the Premises shall not be exclusive to the Supplier but only such as 
shall enable the Supplier to carry out the Services concurrently with the execution of 
work by others. The Supplier shall co-operate with such others as the 
Purchaser may reasonably require. 


7.3 The Purchaser shall have the power at any time during the progress of the Services 
to order in writing: 


(a) the removal from the Premises of any materials which in the opinion of the 
Purchaser are either hazardous, noxious or not in accordance with the 
Contract, and/or 


(b) the substitution of proper and suitable materials, and/or 


(c) the removal and proper re-execution notwithstanding any previous test thereof 
or interim payment therefor of any work which, in respect of material or 
workmanship is not in the opinion of the Purchaser in accordance with the 
Contract. 


7.4. The Supplier shall forthwith comply with any order made under Condition 7.3. 


7.5 On completion of the Services the Supplier shall remove the Suppliers plant, 
equipment and unused materials and shall clear away from the Premises all rubbish 
arising out of the Services and leave the Premises in a neat and tidy condition. 


8. HEALTH AND SAFETY 


The Supplier shall perform the Services in such a manner as to be safe and without risk to 
the health or safety of persons in the vicinity of the place where the Services are being 
performed (whether such persons are in the vicinity of the said place at the time when the 
Services are being performed or otherwise) and in such a manner as to comply with any 
relevant health and safety or other legislation (including Statutory Instrument, Orders, or 
Regulations made under the said legislation) and any requirements imposed by a local or 
other regulatory authority in connection with the performance of services of the type supplied 
to the Purchaser, whether specifically or generally. The Supplier shall indemnify the 
Purchaser andthe Crown against all actions, suits, claims, demands, losses, charges, costs 
and expenses which the Purchaser or the Crown may suffer or incur as a result of or in 
connection with any breach of this Condition. 


9. TIME OF PERFORMANCE 


The Supplier shall begin performing the Services on the date stated in the Purchase Order 
and shall complete the Services by the date stated in the Purchase Order or continue to 
perform them for the period stated in the Purchase Order (whichever is applicable). Time is 
of the essence of the Contract. The Purchaser may by written notice require the Supplier to 
execute the Services in such order as the Purchaser may decide. In the absence of such 
notice the Supplier shall submit such detailed programmes of work and progress reports as 
the Purchaser may from time to time require. 


10. PAYMENT 
10.1.1 Unless otherwise stated in the Contract, payment will be made within 30 days of 


receipt and agreement of invoices, submitted monthly in arrears, for work completed 
to the satisfaction of the Purchaser. 
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10.1.2 In this Condition 10, ‘invoice’ includes an electronic invoice meeting all requirements 
set out in regulation 70A of the Public Contracts (Scotland) Regulations 2015 or 
regulation 44A of the Concession Contracts (Scotland) Regulations 2016. 


10.2 Value Added Tax, where applicable, shall be shown separately on all invoices as a 
strictly net extra charge. 


10.3 Notwithstanding Condition 21 (Assignation and sub-contracting) of this Contract the 
Supplier may assign to another person (an “assignee’”) the right to receive payment 
of the Price or any part thereof due to the Supplier under this Contract subject to (i) 
deduction of sums in respect of which the Purchaser exercises the right of recovery 
under Condition 20 (Recovery of sums due) of this Contract and (ii) all the related 
rights of the Purchaser under this Contractin relation to the recovery of sums due but 
unpaid. The Supplier shall notify or procure that any assignee notifies the Purchaser 
of any variations to the arrangements for payment of the Price or for handling invoices, 
in each case in good time to enable the Purchaser to redirect payments or invoices 
accordingly. In the absence of such notification the Purchaser shall be under no 
obligation to vary the arrangements for payment of the Price or for handling 
invoices. 


11. FREE-ISSUE MATERIALS 


Where the Purchaser for the purpose of the Contract issues materials free of charge to the 
Supplier such materials shall be and remain the property of the Purchaser. The Supplier shall 
maintain all such materials in good order and condition and shall use such materials solely in 
connection with the Contract. The Supplier shall notify the Purchaser of any surplus 
materials remaining after completion of the Services and shall dispose of them as the 
Purchaser may direct. Waste of such materials arising from bad workmanship or negligence of 
the Supplier or any of the Supplier’s servants, agents or sub-contractors shall be made good 
at the Supplier’s expense. Without prejudice to any other of the rights of the Purchaser, the 
Supplier shall deliver up such materials whether processed or not to the Purchaser on 
demand. 


12. AUDIT 


12.1 The Supplier shall keep and maintain until 5 years after the Contract has been 
completed records to the satisfaction of the Purchaser of all expenditures which are 
reimbursable by the Purchaser and of the hours worked and costs incurred in 
connection with any employees of the Supplier paid for by the Purchaserona_ time 
charge basis. The Supplier shall on request afford the Purchaser or the Purchaser's 
representatives such access to those records as may be required by the Purchaser in 
connection with the Contract. 


12.2 The provisions of this Condition 12 shall apply during the continuance of this Contract 
and after its termination howsoever arising. 


13. © CORRUPT GIFTS OR PAYMENTS 


The Supplier shall not offer or give, or agree to give, to any employee or representative of the 
Purchaser any gift or consideration of any kind as an inducement or reward for doing or 
refraining from doing or for having done or refrained from doing, any act in relation to the 
obtaining or execution of this or any other contract with the Purchaser or for showing or 
refraining from showing favour or disfavour to any person in relation to this or any such 
contract. The attention of the Supplier is drawn to the criminal offences created by the Bribery 
Act 2010. 


14. INTELLECTUAL PROPERTY RIGHTS 
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14.1 All Intellectual Property Rights in any material including but not limited to reports, 
guidance, specification, instructions, toolkits, plans, data, drawings, databases, 
patents, patterns, models, designs which are created or developed by the Supplier on 
behalf of the Purchaser for use, or intended use, in relation to the performance by the 
Supplier of its obligations under the Contract are hereby assigned to and shall vest 
in the Crown absolutely. 


14. 2 Except as may expressly be provided for in the Contract, neither party acquires any 
interest in or license to use the other party’s Intellectual Property Rights owned or 
developed prior to or independently of the Contract. 


14.3 The Supplier must not infringe any Intellectual Property Rights of any third party in 
providing the Services or otherwise performing its obligations under the Contract. The 
Supplier shall indemnify the Purchaser against all actions, claims, demands, losses, 
charges, costs and expenses which the Purchaser may suffer or incur as a resut of or 
in connection with any breach of this Condition 14.3. 


14.4 The provisions of this Condition 14 shall apply during the continuance of this Contract 
and after its termination howsoever arising. 


15. INDEMNITY AND INSURANCE 


15.1 Without prejudice to any rights or remedies of the Purchaser the Supplier shall 
indemnify the Purchaser and the Crown against all actions, suits, claims, demands, 
losses, charges, costs and expenses which the Purchaser or the Crown may suffer or 
incur as a result of or in connection with any damage to property or in respect of any 
injury (whether fatal or otherwise) to any person which may result directly or 
indirectly from any negligent or wrongful act or omission of the Supplier. 


15.2 The Purchaser shall indemnify the Supplier in respect of all claims, proceedings, 
actions, damages, fines, costs, expenses or other liabilities which may arise out of, or 
in consequence of, a breach of the Data Protection Laws where the breach is the 
direct result of the Supplier acting in accordance with the Purchaser's specific written 
instructions. This indemnity provision shall not apply if the Supplier- 


(a) acts onthe Purchaser’s specific written instructions but fails to notify the 
Purchaser in accordance with Condition 28.12(c) of this Contract; 


(b) fails to comply with any other obligation under the Contract. 


15.3 Except in the case of loss, damage or personal injury (including death) suffered by an 
employee of the Supplier (in respect of which the indemnity in Condition 15.1 shall apply 
whether or notthe loss, damage or personal injury was caused by the negligent or wilful 
act or omission of the Purchaser, the Crown or any servant or agent of the Crown) the 
indemnity contained in Condition 15.1 shall not apply to the extent that the loss, 
damage or injury is caused by the negligent or wilful act or omission of the Purchaser, 
the Crown or any servant or agent of the Crown. 


15.4 The Supplier shall have in force and shall require any sub-Contractorto have in force: 


(a) employer's liability insurance in accordance with any legal requirements for the 
time being in force, and 


(b) public liability insurance for such sum and range of cover as the Supplier 
deems to be appropriate but covering at least all matters which are the subject 
of indemnities or compensation obligations under these Conditions in the sum 
of not less than £1 million for any one incident and unlimited in total, unless 
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otherwise agreed by the Purchaser in writing. 


15.5 The policy or policies of insurance referred to in Condition 15.4 shall be shown to the 
Purchaser whenever the Purchaser requests, together with satisfactory evidence of 
payment of premiums, including the latest premium due thereunder. 


16. DISCRIMINATION 


The Supplier must not unlawfully discriminate against any person within the meaning of the 
Equality Act 2010 in its activities relating to the Contract or any other contract with the 
Purchaser. 


17. BLACKLISTING 


The Supplier must not commit any breach of the Employment Relations Act 1999 (Blacklists) 
Regulations 2010 or section 137 of the Trade Union and Labour Relations (Consolidation) Act 
1992, or commit any breach of the Data Protection Laws by unlawfully processing Personal Data 
in connection with any blacklisting activities. Breach of this Condition is a material default which 
shall entitle the Purchaser to terminate the Contract. 


18. OFFICIAL SECRETS ACT, CONFIDENTIALITY, AND ACCESS TO 
GOVERNMENT INFORMATION 


18.1 The Supplier undertakes to abide and procure that the Supplier’s employees abide 
by the provisions of the Official Secrets Acts 1911 to 1989. 


18.2 The Supplier shall keep secret and not disclose and shall procure that the Supplier's 
employees keep secret and do not disclose any information of a confidential nature 
obtained by the Supplier by reason of this Contract except information which is in the 
public domain otherwise than by reason of a breach of this provision. 


18.3 All information related to the Contract will be treated as commercial in confidence by 
the parties except that: 


(a) The Supplier may disclose any information as required by Lawor judicial order 
to be disclosed. 


(b) The Purchaser may disclose any information as required by Law or judicial 
order to be disclosed. Further, the Purchaser may disclose all information 
obtained by the Purchaser by virtue of the Contract to the Scottish or United 
Kingdom Parliament or any other department, office or agency of Her 
Majesty’s Government in Scotland or the United Kingdom, and their servants 
or agents. When disclosing such information to either the Scottish Parliament 
or the United Kingdom Parliament it is recognised and agreed by both parties 
that the Purchaser shall if the Purchaser sees fit disclose such information but 
is unable to impose any restrictions upon the information that the Purchaser 
provides to Members of the Scottish Parliament, (MSPs) or Members of the 
United Kingdom Parliament (MPs). Such disclosure shall not be treated as a 
breach of this Contract. 


18.4 The provisions of this Condition 18 shall apply during the continuance of this Contract 
and after its termination howsoever arising. 


18.5 The Parties acknowledge that, except for any Information which is exempt from 
disclosure in accordance with the provisions of the FOISA, the content of the Contract 
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is not confidential information and the Supplier hereby gives its consent for the 
Purchaser to publish the Contract in its entirety to the general public (but with any 
Information that is exempt from disclosure in accordance with the FOISA redacted) 
including any changes to the Contract agreed from time to time 


19. TERMINATION 


19.1 The Supplier shall notify the Purchaser in writing immediately upon the occurrence 
of any of the following events: 


(a) where the Supplier is an individual and if a petition is presented for 
the Supplier’s bankruptcy or the sequestration of the Supplier's estate or a 
criminal bankruptcy order is made against the Supplier, or the Supplier is 
apparently insolvent, or makes any composition or arrangement with or for the 
benefit of creditors, or makes any conveyance or assignation for the 
benefit of creditors, or if an administrator or trustee is appointed to manage 
the Supplier’s affairs; or 


(b) where the Supplier is not an individual but is a firm, or a number of persons 
acting together in any capacity, if any event in (a) or (c) of this Condition 
occurs in respect of the firm or any partner inthe firm or any of those persons or 
a petition is presented for the Supplier to be wound up as an unregistered 
company; or 


(c) where the Supplier is a company, if the company passes a resolution for 
winding-up of dissolution (otherwise than for the purposes of and followed by an 
amalgamation or reconstruction) or the court makes an administration order 
or a winding-up order, or the company makes a composition or arrangement 
with its creditors, or an administrator, administrative receiver, receiver or 
manager is appointed by a creditor or by the court, or possession is taken of 
any of its property under the terms of a floating charge. 


19.2 On the occurrence of any of the events described in Condition 19.1 or, if the Supplier 
shall have committed a material breach of this Contract and (if such breachis capable of 
remedy) shall have failed to remedy such breach within 30 days of being required by 
the Purchaser in writing to do so or, where the Supplier is an individual if the 
Supplier shall die or be adjudged incapable of managing his or her affairs within the 
meaning of the Adults with Incapacity (Scotland) Act 2000 or the Mental Health (Care 
and Treatment) (Scotland) Act 2003, the Purchaser shall be entitled to terminate this 
Contract by notice to the Supplier with immediate effect. Thereupon, without prejudice 
to any other of the Purchaser’s rights, the Purchaser may complete the Services or 
have them completed by a third party, using for that purpose (making a fair and proper 
allowance therefor in any payment subsequently made to the Supplier) all materials, 
plant and equipment on the Premises belonging to the Supplier, and the Purchaser 
shall not be liable to make any further payment to the Supplier until the Services have 
been completed in accordance with the requirements of the Contract, and shall be 
entitled to deduct from any amount due to the Supplier the costs thereof incurred by 
the Purchaser (including the Purchaser’s own costs). If the total cost to the Purchaser 
exceeds the amount (if any) due to the Supplier, the difference shall be recoverable by 
the Purchaser from the Supplier. 


19.3 The Purchaser may terminate the Contract in the event that: 


(a) the Contract has been subject to substantial modification which would have 
required a new procurement procedure in accordance with regulation 72(9) 
(modification of contracts during their term) of The Public Contracts (Scotland) 
Regulations 2015; 


(b) the Supplier has, at the time of contract award, been in one of the situations 
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referred to in regulation 58(1) (exclusion grounds) of The Public Contracts 
(Scotland) Regulations 2015, including as a result of the application of 
regulation 58(2) of those regulations, and should therefore have been excluded 
from the procurement procedure; or 


19.4 The Purchaser may also terminate the Contract in the event of a failure by the 
Supplier to comply in the performance of the Services with legal obligations in the 
fields of environmental, social and employment Law. 


19.5 In addition to the Purchaser’s rights of termination under Condition 19.2, 19.3 and 
19.4, the Purchaser shall be entitled to terminate this Contract by giving to the Supplier 
not less than 30 days notice to that effect. 


19.6 Termination under Condition 19.2, 19.3, 19.4 or 19.5 shall not prejudice or affect any 
right of action or remedy which shall have accrued or shall thereupon accrue to the 
Purchaser and shall not affect the continued operation of Conditions 12(Audit), 14 
(Intellectual Property Rights), 18 (Official Secrets Acts, etc.), 27 (TUPE) and 28 (Data 
Protection). 


20. RECOVERY OF SUMS DUE 


Wherever under this Contract any sum of money is recoverable from or payable by the 
Supplier, that sum may be deducted from any sum then due, or which at any later time may 
become due, to the Supplier under this Contract or under any other agreement or contract 
with the Purchaser or with any department, agency or authority of the Crown. 


21. ASSIGNATION AND SUB-CONTRACTING 


21.1 The Supplier shall not assign or sub-contract any portion of the Contract without the 
prior written consent of the Purchaser. Sub-contracting any part of the Contract shall 
not relieve the Supplier of any obligation or duty attributable to the Supplier under the 
Contract or these Conditions. 


21.2 Where the Purchaser has consented to the placing of sub-contracts, copies of each 
sub-contract shall be sent by the Supplier to the Purchaser immediately it is issued. 


21.3 Where the Supplier enters into a sub-contract must ensure that a provision is included 
which: 


21.3.1 requires payment to be made of all sums due by the Supplier to the sub- 
contractor within a specified period not exceeding 30 days from the receipt of a 
valid invoice as defined by the sub-contract requirements and provides that, 
where the Purchaser has made payment to the Supplier in respect of Services 
and the sub-contractor’s invoice relates to such Services then, to that extent, 
the invoice must be treated as valid and, provided the Supplier is not exercising 
a right of retention or set-off in respect of a breach of contract by the sub- 
contractor or in respect of a sum otherwise due by the sub-contractor to the 
Supplier, payment must be made to the sub-contractor without deduction; 


21.3.2 notifies the sub-contractor that the sub-contract forms part of a larger contract 
for the benefit of the Purchaser and that should the sub-contractor have any 
difficulty in securing the timely payment of an invoice, that matter may be 
referred by the sub-contractor to the Purchaser; and 


21.3.3 in the same terms as that set out in this Condition 21.3 (including for the 
avoidance of doubt this Condition 21.3.3) subject only to modification to refer 
to the correct designation of the equivalent party as the Supplier and sub- 
contractor as the case may be. 
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21.4 The Supplier shall also include in every sub-contract: 


21.4.1 a right for the Supplier to terminate that sub-contract if the relevant sub- 
contractor fails to comply in the performance of its contract with legal 
obligations in the fields of environmental, social or employment Law or if any 
of the termination events (involving substantial modification of the Contract, 
contract award despite the existence of exclusion grounds) specified in 
Condition 19.3 occur; and 


21.4.2 a requirement that the sub-contractor includes a provision having the same 
effect as 21.4.1 above in any sub-contract which it awards. 


In this Condition 21.4, ‘sub-contract’ means a contract between two or more suppliers, at any 
stage of remoteness from the Purchaser in a sub-contracting chain, made wholly or 
substantially for the purpose of performing (or contributing to the performance of) the whole or 
any part of this Contract. 


22. NOTICES 


Any notice given under or pursuant to the Contract may be sent by hand or by post or by 
registered post or by the recorded delivery service or transmitted by telex, telemessage 
facsimile transmission or other means of telecommunication resulting in the receipt of a 
written communication in permanent form and if so sent or transmitted to the address of the 
party shown on the Purchase Order, or to such other address as the party may by notice to 
the other have substituted therefor, shall be deemed effectively given on the day when in the 
ordinary course of the means of transmission it would first be received by the addressee in 
normal business hours. 


23. COMPLIANCE WITH THE LAW ETC. 


In providing the Services and otherwise when performing the Contract, the Supplier must 
comply in all respects with: 


23.1 all applicable Law; 
23.2 any applicable requirements of regulatory bodies; and 


23.3 Good Industry Practice. 


24. DISPUTE RESOLUTION 


24.1 The parties must attempt in good faith to resolve any dispute between them arising 
out of or in connection with the Contract. 


24.2 Any dispute or difference arising out of or in connection with the Contract, including 
any question regarding its existence, validity or termination which cannot be resolved 
in good faith, shall be determined by the appointment of a single arbitrator to be 
agreed between the parties, and failing agreement within 14 days after either party 
has given to the other a witten request to concur in the appointment of an arbitrator, 
by an arbitrator to be appointed by the Scottish Arbitration Centre on the written 
application of either party. The seat of the arbitration shall be in Scotland. The 
language used in the arbitral proceedings shall be English. 


24.3 Any arbitration under 24.2 is subject to the Arbitration (Scotland) Act 2010. 


25. HEADINGS 
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The headings to Conditions shall not affect their interpretation. 


26. GOVERNING LAW 


These Conditions shall be governed by and construed in accordance with Scottish Law and 
the Supplier hereby irrevocably submits to the jurisdiction of the Scottish courts. The 
submission to such jurisdiction shall not (and shall not be construed so as to) limit the right of 
the Purchaser to take proceedings against the Supplier in any other court of competent 
jurisdiction, nor shall the taking of proceedings in any one or more jurisdictions preclude the 
taking of proceedings in any other jurisdiction, whether concurrently or not. 


27. TUPE 


27.1 The Supplier recognises that the Transfer of Undertakings (Protection of Employment) 
Regulations 2006 (TUPE) may apply in respect of the Contract, and that for the 
purposes of those Regulations, the undertaking concerned (or any relevant part 
of the undertaking) shall (a) transfer to the Supplier on the commencement of the 
Contract; (b) transfer to another supplier on the expiry of the Contract. 


27.2 During the period of six months preceding the expiry of the Contract or after the 
Purchaser has given notice to terminate the Contract or the Supplier stops trading, and 
within 20 working days of being so requested by the Purchaser, the Supplier shall 
fully and accurately disclose to the Purchaser or to any person nominated by the 
Purchaser information relating to employees engaged in providing the Services in 
relation to the Contract in particular, but not necessarily restricted to, the following: 


(a) the total number of personnel whose employment with the Supplier is liable to 
be terminated at the expiry of this Contract but for any operation of Law; and 


(b) for each person, age and gender, details of their salary, date of 
commencement of continuous employment and pay settlements covering that 
person which relate to future dates but which have already been agreed and 
their redundancy entitlements (the names of individual members of staff do not 
have to be given); and 


(c) information about the other terms and conditions on which the affected staff 
are employed, or about where that information can be found; and 


(d) details of pensions entitlements, if any. 


27.3 The Supplier shall permit the Purchaser to use the information for the purposes of 
TUPE and of re-tendering, which shall include such disclosure to potential suppliers 
as the Purchaser considers appropriate in connection with any re-tendering. The 
Supplier will co-operate with the re-tendering of the contract by allowing the transferee 
to communicate with and meet the affected employees and/or their representatives. 


27.4 The Supplier agrees to indemnify the Purchaser fully and to hold it harmless at all 
times from and against all actions, proceedings, claims, expenses, awards, costs and 
all other liabilities whatsoever in any way connected with or arising from or relating to 
the provision or disclosure of information permitted under this Condition. 


27.5 In the event that the information provided by the Supplier in accordance with this 
Condition becomes inaccurate, whether due to changes to the employment and 
personneldetails of the affected employees made subsequent to the original provision 
of such information or by reason of the Supplier becoming aware that the information 
Originally given was inaccurate, the Supplier shall notify the Purchaser of the 
inaccuracies and provide the amended information. The Supplier shall be liable 


for any increase in costs the Purchaser may incur as a result of the inaccurate or late 
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27.6 


28. 


28.1 


28.2 


28.3 


28.4 


28.5 


production of data. 


The provisions of this Condition 27 shall apply during the continuance of this Contract 
and after its termination howsoever arising. 


Data Protection 


The Supplier acknowledges that any Personal Data described in the scope of the 
Schedule Part 1 (Data Protection) may be Processed in connection with the Services 
under this Contract. For the purposes of any such Processing, Parties agree that the 
Supplier acts as the Data Processor and the Purchaser acts as the Data Controller. 


Both Parties agree to negotiate in good faith any such amendments to this Contract 
that may be required to ensure that both Parties meet all their obligations under Data 
Protection Laws. The provisions of this Condition 28 are without prejudice to any 
obligations and duties imposed directly on the Supplier under Data Protection Laws 
and the Supplier hereby agrees to comply with those obligations and duties. 


The Supplier will, in conjunction with the Purchaser and in its own right and in respect 
of the Services, make all necessary preparations to ensure it will be compliant with 
Data Protection Laws. 


The Supplier will provide the Purchaser with the contact details of its data protection 
officer or other designated individual with responsibility for data protection and privacy 
to act as the point of contact for the purpose of observing its obligations under the Data 
Protection Laws. 


The Supplier must: 


28.5.1 process Personal Data only as necessary in accordance with obligations under 
the Contract and any written instructions given by the Purchaser (which may 
be specific or of a general nature), including with regard to transfers of Personal 
Data to a Third Country other than within the European Economic Area unless 
required to do so by European Union or domestic Law or Regulatory Body to 
which the Supplier is subject; in which case the Supplier must, unless prohibited 
by that Law, inform the Purchaser of that legal requirement before processing 
the Personal Data only to the extent, and in such manner as is necessary for 
the performance of the Supplier's obligations under this Contract or as is 
required by the Law; 


28.5.2 subject to Condition 28.5.1 only process or otherwise transfer any Personal 
Data in or toa Third Country other than within the European Economic Area 
with the Purchaser’s prior written consent; 


28.5.3 take all reasonable steps to ensure the reliability and integrity of any Supplier 
Personnel who have access to the Personal Data and ensure that the Supplier 
Personnel: 


(a) are aware of and comply with the Supplier’s duties under this Condition; 

(b) are subject to appropriate confidentiality undertakings with the Supplier 
or the relevant Sub-contractor; 

(c) are informed of the confidential nature of the Personal Data and do not 
publish, disclose or divulge any of the Personal Data to any third party 
unless directed in writing to do so by the Purchaser or as otherwise 
permitted by this Contract; and 
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(d) have undergone adequate training in the use, care, protection and 
handling of Personal Data. 


28.5.4 implement appropriate technical and organisational measures in accordance 
with Article 32 of the UK GDPR to protect Personal Data against unauthorised 
or unlawful Processing and against accidental loss, destruction, damage, 
alteration or disclosure, such measures being appropriate to the harm which 
might result from any unauthorised or unlawful Processing accidental loss, 
destruction or damage to the Personal Data and having regard to the nature of 
the Personal Data which is to be protected. 


28.6 The Supplier shall not engage a sub-contractor to carry out Processing in connection 
with the Services without prior specific or general written authorisation from the 
Purchaser. In the case of general written authorisation, the Supplier must inform the 
Purchaser of any intended changes concerning the addition or replacement of any 
other sub-contractor and give the Purchaser an opportunity to object to such changes. 


28.7 If the Supplier engages a sub-contractor for carrying out Processing activities on behalf 
of the Purchaser, the Supplier must ensure that same data protection obligations as 
set out in this Contract are imposed on the sub-contractor by way of a written and 
legally binding contract, in particular providing sufficient guarantees to implement 
appropriate technical and organisational measures. The Supplier shall remain fully 
liable to the Purchaser for the performance of the sub-contractor’s performance of the 
obligations. 


28.8 The Supplier must provide to the Purchaser reasonable assistance including by such 
technical and organisational measures as may be appropriate in complying with Articles 12- 
23 of the UK GDPR. 


28.9 The Supplier must notify the Purchaser if it: 


(a) receives a Data Subject Access Request (or purported Data Subject Access 
Request); 


(b) receives a request to rectify, block or erase any Personal Data; 


(c) receives any other request, complaint or communication relating to either 
Party's obligations under the Data Protection Laws; 


(d) receives any communication from the Information Commissioner or any 
other regulatory authority in connection with Personal Data processed 
under this Contract; or 


(e) receives a request from any third Party for disclosure of Personal Data where 
compliance with such request is required or purported to be required by Lawor 
regulatory order; 


and such notification must take place as soon as is possible but in any event within 
3 business days of receipt of the request or any other period as agreed in writing 
with the Purchaser from time to time. 


28.10 Taking into account the nature of the Processing and the information available, the 
Supplier must assist the Purchaser in complying with the Purchaser’s obligations 
concerning the security of Personal Data, reporting requirements for data breaches, 
data protection impact assessments and prior consultations in accordance with Articles 
32 to 36 of the UK GDPR. These obligations include: 


(a) ensuring an appropriate level of protection through technical and organisational 
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measures that take into account the circumstances and purposes of the 
processing as well as the projected probability and severity of a possible 
infringement of the Law as a result of security vulnerabilities and that enable an 
immediate detection of relevant infringement events. 


(b) notifying a Personal Data breach to the Purchaser without undue delay and in 
any event no later than 24 hours after becoming aware of a Personal Data 
breach; 

(c) assisting the Purchaser with communication of a Personal Data breach 
to a Data Subject; 


(d) supporting the Purchaser with preparation of a data protection impact 
assessment; 


(e) supporting the Purchaser with regard to prior consultation of the Information 
Commissioner. 


28.11 At the end of the provision of Services relating to processing the Supplier must, on 
written instruction of the Purchaser, delete or return to the Purchaser all Personal Data 
and delete existing copies unless EU or domestic Law requires storage of the 
Personal Data. 


28.12 The Supplier must: 


(a) provide such information as is necessary to enable the Purchaser to satisfy 
itself of the Supplier's compliance with this Condition 28; 


(b) allow the Purchaser, its employees, auditors, authorised agents or advisers 
reasonable access to any relevant premises, during normal business hours, to 
inspect the procedures, measures and records referred to in this Condition 28 
and contribute as is reasonable to those audits and inspections; 


(c) inform the Purchaser, if in its opinion, an instruction from the Purchaser 
infringes any obligation under the Data Protection Laws. 


28.13 The Supplier must maintain written records of all Processing activities carried out in 
performance of the Services or otherwise on behalf of the Purchaser. Such records 
must contain the information set out in Article 30(2) of the UK GDPR and may be kept 
in electronic form,. 


28.14 If requested, the Supplier must make such records referred to in Condition 28.13 
available to the Information Commissioner on request and co-operate with the 
Information Commissioner in the performance of its tasks. 


28.15 Parties acknowledge that the inspecting party will use reasonable endeavours to carry 
out any audit or inspection under Condition 28.14 with minimum disruption to the 
Supplier’s day to day business. 
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SUPPLEMENTARY NOTICE 
LATE PAYMENT OF INVOICES 


Suppliers to the National Records of Scotland are requested to address complaints 
regarding late payment of invoices to, in the first instance, the addressee of the 
invoice and, in the second instance to the Chief Purchasing/Procurement Officer, 
Ladywell House, Ladywell Road, Edinburgh, EH12 7TF. This procedure is 
suggested as the best practical way of ensuring problems of late payment are 
resolved, and is not intended to interfere with Suppliers legal rights. 


THIS NOTICE DOES NOT FORM PART OF THE CONDITIONS OF CONTRACT 


SCHEDULES 


The following two schedules may be required to form part of the contract. 


PART 1 DATA PROTECTION 
PART 2 CYBER SECURITY REQUIREMENTS 


Where either, or both, of these schedules are required it will be clearly stated by the 
Purchaser in the tender documents: 
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This is the Schedule referred to in the foregoing Conditions of Contract for the Purchase 
of Services between [PURCHASER NAME] and [SUPPLIER NAME] 


SCHEDULE 
PART 1 
DATA PROTECTION 


Data Processing provision as required by Article 28(3) UK GDPR. 


This Schedule Part 1 includes certain details of the Processing of Personal Data in 
connection with the Services: Subject matter and duration of the Processing of Personal 
Data 


il 
il 


The obligations and rights of the Purchaser as the Data Controller are set out in 
Condition 28 of the Contract. 
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This is the Schedule referred to in the foregoing Conditions of Contract for the Purchase 
of Services between [PURCHASER NAME] and [SUPPLIER NAME] 
SCHEDULE PART 2 
CYBER SECURITY REQUIREMENTS 


Drafting notes: 

° Please note that this Schedule Part 2 including the Annex are optional. The Purchaser may choose to incorporate these in 
the Contractat its discretion. 

° Textin red requiresto be amended/updated by the Purchaser to reflect the specific circumstances of the Contract. 





1. DEFINITIONS 
1.1. The defined terms used in this Schedule Part 2 shall have the following meanings: 


[“Cyber Implementation Plan” means the cyber implementation plan set out in Section B 
(Cyber Implementation Plan)] of the Annex to Schedule Part 2 (Cyber Security 
Requirements);] 


Drafting note: where the Purchaser and the Supplier have agreed a Cyber Implementation Plan, the above definition should be 
included. Otherwise it may be removed. 





“Cyber Security Incident” means any thing, event, act or omission which gives, or may 
give, rise to: 


(i) unauthorised access to any information system, data or electronic 
communications network (including breach of an applicable security policy); 

(ii) reduced integrity of an information system, data or electronic communications 
network; 

(iii) unauthorised use of any information system or electronic communications 
network for the processing (including storing) of data; 

(iv) disruption or change of the operation (including, but not limited to, takeover of 
control, malicious disruption and/or denial of service) of an information system or 
electronic communications network; 

(v) unauthorised changes to firmware, software or hardware; 

(vi) unauthorised destruction, damage, deletion or alteration of data residing in an 
information system or electronic communications network; 

(vii) | removal or limiting the availability of, or possibility to use, data residing in an 
information system or electronic communications network; 

(viii) the appropriation, publication, dissemination or any other use of data by persons 
unauthorised to do so; or 

(ix) a breach of the Computer Misuse Act 1990, the Network and Information Sy stems 
Regulations 2018, the Data Protection Laws, the Privacy and Electronic Communications 
(EC Directive) Regulations 2003, the Communications Act 2003, the Official Secrets Act 
1911 to 1989, or any other applicable legal requirements in connection with cybersecurity 
and/or privacy 


in connection with the Goods and/or the Contract; 
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rafting note: Please note that the Privacy and Electronic Communications irective) Regulations are planned to be 
replaced with new legislationin the future. 





“Cyber Security Requirements” means the Purchaser's requirements in connection with cyber 
security as set out in Section A (Cyber Security Requirements [and Section B (Cyber 
Implementation Plan)| of the Annex to this Schedule Part 2 (Cyber Security Requirements), 
[the Purchase Order, paragraph [ ] ofthe tender documentation and[ ] of the Contract]; 


Drafting note: 
° The Purchaser should amendthe above definition asappropriate. 
o Reference to Cyber Implementation Plan may not be required where a Cyber Implementation Plan will not be 
incorporated intothe contract. 
o If the Purchase Order, the Contract or tender documentation include any additional requirementsrelevantto cyber 
security, the Purchaser may wish to reference these here. The Purchaser may wish to refer to specific paragraphs 
within the Purchase Order and/or the tender documentation and/or other part of the Contract. 








2. CYBER SECURITY REQUIREMENTS 
2.1 The Supplier shall comply with the Cyber Security Requirements and shall implement and 
maintain all security measures: 
(a) as may be required under applicable laws (including but not limited to the 
Network and Information Systems Regulations 2018); 


(b) to enable it to discharge its obligations under this Schedule Part 2 (Cyber 
Security Requirements); and 


(c) to ensure there are no Cyber Security Incidents 


in all cases to the Purchaser’s reasonable satisfaction and in accordance with Good Industry 
Practice. 


2.2 The Supplier shall notify the Purchaserimmediately it knows or believes that a Cyber Security 
Incident has or may have taken place and shall provide full details of the incident and any 
mitigation measures already taken and intended to be taken by it and (where applicable) any 
mitigation measures recommended by it to be taken by the Purchaser. 


2.3 If the Supplier fails to comply with the provisions of paragraphs 2.1 and/or 2.2, the Purchaser 
may take any action it considers appropriate or necessary (and the Supplier shall comply 
with the Purchaser’s requests in this respect). 
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ANNEX 


| Drafting note: This Annex isnotrequired where Schedule Part 2 isnotincorporatedinto the Contract, atthe Purchaser's sole option. 


The cyber security requirements applicable to the Contract are set outin this Annex to Schedule 
Part 2. Section A (Cyber Security Requirements) includes the Purchaser’s requirements in 
connection with cyber security [and Section B (Cyber Implementation Plan) sets out further 
details on how the Supplier will meet such requirements]. 





Drafting note: The Purchaser should retainthe reference to SectionB above if: 

e the Scottish Cyber Assessment Service (SCAS) tool hasbeen used in connection with the contract; and 

° the Supplier and the Purchaser have agreed a Cyber Implementation Plan in conjunction with the SAQre port generated by 
the SCAS tool 





Section A: Cyber Security Requirements 


Overview of requirements: 


[Cyber risk profile] e [Low 

[Additional questions for e [Cloud security] 
management of specific e [Personal data security] 
cyber risks covering:] [Governance] 


[Certification requested for [Cyber Essentials or equivalent] 

assurance purposes] [Cyber Essentials Plus or equivalent] 
[IASME Gold or equivalent] 
[ISO27001 or equivalent] 


required] required 

management approach] e [Cyber Implementation Plans accepted 
Drafting note: If the SCAS tool isused, insert information inthe above table that summarisesthe Purchaser's cyber security 
requirements. Cyber security requirements set out in this Schedule Part 2 and the Annex should not deviate from the 


requirementsset outin any part of the tender documentation. An exampleisprovided above. The Purchaser should checkand 
amend fieldsand entriesto fit its contract. 








The Supplier shall meet the following requirements: 


Drafting note: If the SCAS tool isused, the Purchaser’s requirementsfrom SCAS require to be incorporated into the contract. 

Two optionsto achieve thisinclude the following: 

° OPTION 1: Either cut and paste or append the full “SAQ Responses’ section of the Suppliers SAQ Report, which sets out 
all questions asked of bidding suppliersin the SCAS SAQ (i.e. the Purchaser's requirements), and the Supplier’sresponses 
Please also include details of subsequent clarificationswith the Supplier, if applicable. 

e OPTION 2: provide the following information (asset out in the table below) from the SCAS tool. 


The Purchaser should choose the option appropriate to the contract, Option 1 being preferable from the pointof view of clarity. 
In case of Option 2, the Purchaser should retain records of its requirementsand the Suppliersresponses. The Purchaser 
should also retain all metadata / other information (such ase-mail alerts) generated by SCAS relating to completion of SAQsby 
it and the Supplier. 
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The cyber security [Insert reference number for contract] 
requirements for the 


Contract, and the Supplier’s 
responses, are set out in the 
Scottish Cyber Assessment 
Service under the following 
reference number: 


Time that the Supplier [Insert the time and date at which the 
submitted its responses to Supplier submitted its response to the SAQ 
the above cyber security via SCAS] 

requirements via SCAS: 


Details of any subsequent [Insert details of any subsequent 
clarifications: clarifications] 





Drafting note: If SCAS is NOT used, the Purchaser should insert applicable cyber security requirementshere. Thismay 
include extracting / making reference to relevant parts of the Purchase Order and/or other parts of the Contract and/or the 
tender documentation. Cyber security requirements set out in this Schedule Part 2 andthe Annex should not deviate from the 
requirements set outin any part of the tender documentation. 





[Section B: Cyber Implementation Plan 


Drafting note: If SCAS is used, and a Cyber Implementation Plan hasbeen submitted by the Supplier and agreed by the 
Purchaser, the Purchaser should include this section B and the text below (if not, this section B may be deleted). Ensure that 
the date orcontract phase isamended to align withthe requirements communicated inthe Purchase Order and/or any other 
part of the Contract and/or the tender documentation andthe SCAS tool. 


The Purchaser should insert below the frequency of review of the Cyber Implementation Plan with the Supplier. This should 
match any frequency indicated inthe Purchase Order and/or elsewhere inthe Contract and/or the tender documentation . 
The template Cyber Implementation Plan may be found from the following address: https://www.gov.scot/publications/cyber- 
resilience-supply-chain-guidance 





The Supplier shall follow the agreed Cyber Implementation Plan to meet the requirements of 
Section A by no later than the date(s) set out in the Cyber Implementation Plan. The parties 
shall review the Supplier’s progress on the Cyber Implementation Plan regularly every [4 
weeks]. If the Supplier fails to meet the commitments set out in the Cyber Implementation Plan, 
this shall be considered to be a material breach of the Contract for the purposes of Condition 
19.2 (Termination). 


Drafting note: Insert or append the agreed Cyber Implementation Plan below. The template Cyber Implementation Plan may 
be found from the following address: https://www. gov. scot/publications/cyber-resilience-supply-chain-guidance 
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